🚨 CVE-2026-72576
A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. The /admin/ajax/logo-upload endpoint in bl-kernel/ajax/logo-upload.php moves the uploaded file directly to the web root via Filesystem::mv() without invoking sanitizeSVG() or transformImage(), while SVG is present in the ALLOWED_IMG_EXTENSION and ALLOWED_IMG_MIMETYPES allow-lists. A stored script tag in the SVG executes in the browser of any user who loads the logo.

🎖@cveNotify

🚨 CVE-2026-72577
Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprime_gds/flask/app.py applies no authentication to any endpoint. A path traversal in src/fprime_gds/flask/updown.py allows reading and writing arbitrary files outside the upload directory. A hardcoded secret key (CWE-321) in the application enables session forgery. Chained together, these vulnerabilities allow complete compromise of the ground data system and any spacecraft under its control.

🎖@cveNotify

🚨 CVE-2026-72578
A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator. The /admin/ajax.php dispatcher in amp_conf/htdocs/admin/libraries/BMO/Ajax.class.php does not implement CSRF tokens; its only protection is a Referer header check that is bypassed when the request is sent without a Referer header or from a same-site context, enabling attackers to trigger admin operations by luring an administrator to a malicious page.

🎖@cveNotify

🚨 CVE-2026-72579
An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the researcher's workstation. The Source/OBPGSession.py handler parses server response headers without sanitization and passes attacker-controlled field values to subprocess calls, enabling arbitrary command execution when a user performs a data download operation against a tampered server.

🎖@cveNotify

🚨 CVE-2026-72580
An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directly to os.system() without sanitization, enabling command injection via shell metacharacters.

🎖@cveNotify

🚨 CVE-2026-72581
A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to redirect to a Home Assistant instance without validating the destination URL, enabling internal network scanning and access to internal services.

🎖@cveNotify

🚨 CVE-2026-72582
A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The sendOTPEmail function in pkg/auth/local.go dereferences a pointer obtained from an unchecked error path without validating it is non-nil, causing a fatal panic that terminates the entire server when a recovery request is sent to the /api/auth/local/recover endpoint.

🎖@cveNotify

🚨 CVE-2026-72583
A stored cross-site scripting (XSS) vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check. The pkg/rclonefs/base.go PutMultipart function validates the Content-Type header supplied by the client rather than inspecting the actual file content, enabling an attacker to rename a file to .jpg while specifying image/svg+xml to bypass the filter and store a script-bearing SVG in the web root.

🎖@cveNotify

🚨 CVE-2026-72584
A time-of-check/time-of-use (TOCTOU) race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes. The verifyOTPSession function in pkg/auth/local.go reads and increments the attempt counter in separate non-atomic operations, allowing concurrent requests to observe the same attempt count below the threshold and proceed past the limit check before any update is committed.

🎖@cveNotify

🚨 CVE-2026-72586
A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQ_QUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events (DEVICE_BROWSE, HOST_INTERFACES, DEVICE_TAGS_REQUEST, etc.) call isSocketAdminAuthorized() to verify the connection token, but the DAQ_QUERY handler in server/runtime/index.js lacks this check entirely.

🎖@cveNotify

🚨 CVE-2026-72587
A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /_instatic/hole/<nodeId> server island endpoint. The originating-page URL supplied in u seeds the route template frame used for rendering, and the result is stored in a shared cache keyed only on nodeId, enabling an attacker to inject a crafted route that causes all subsequent visitors to receive malformed or attacker-controlled fragment content.

🎖@cveNotify

🚨 CVE-2026-72588
A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code for unregistered ones, enabling attackers to enumerate valid user accounts.

🎖@cveNotify

🚨 CVE-2026-72589
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database without validation. The hook field value is embedded directly into a shell command by crontab.js makeCommand() without sanitization, so a malicious hook value in the imported file results in command execution on the next cron execution cycle.

🎖@cveNotify

🚨 CVE-2026-72590
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the env_vars parameter. The handler appends the env_vars value directly to the crontab file string as '${envVars}\n' without stripping newline characters, enabling an attacker to insert arbitrary cron expressions that execute attacker-controlled commands.

🎖@cveNotify

🚨 CVE-2026-72591
A server-side request forgery (SSRF) vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted image_url value in the PATCH /apis/web/v1/album/{id}/image endpoint. The application fetches the supplied URL server-side without validating the destination host or blocking access to private, loopback, link-local, or internal addresses.

🎖@cveNotify

🚨 CVE-2026-72592
An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter ($upload_ext_filter = array()) and no authentication enabled by default (auth_pass is empty string), allowing an unauthenticated attacker to upload a PHP webshell and execute it by browsing to the uploaded path.

🎖@cveNotify

🚨 CVE-2026-72593
A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and uploading files anywhere on the server filesystem. The authentication check in index.php at line 637 evaluates 'if ($auth_pass == '' || $loggedon==$auth_pass)', and since auth_pass is an empty string in the default configuration, the condition always evaluates to true and grants full access without credentials.

🎖@cveNotify

🚨 CVE-2026-72594
A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar. The avatar upload handler derives the stored file extension and S3 content type from the original filename rather than inspecting file content, enabling an attacker to store an SVG containing a script element that executes in the browser of any user who views the attacker's profile or avatar.

🎖@cveNotify

🚨 CVE-2026-3843
Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux contains a SQL Injection vulnerability (CWE-89) in the system configuration module. A remote attacker can send specially crafted HTTP POST requests to the /php/request.php endpoint via the sql parameter in application/x-www-form-urlencoded data (e.g., action=do&sql=<query_here>&reload_driver=0) to execute arbitrary SQL commands and potentially achieve remote code execution.

🎖@cveNotify

🚨 CVE-2026-31844
An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. Successful exploitation may lead to full compromise of the backend database, including disclosure or modification of stored data.

🎖@cveNotify

🚨 CVE-2026-31846
Missing authentication in the /goform/ate endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows an adjacent unauthenticated attacker to retrieve sensitive device information, including the administrator password. An attacker can decode this value to obtain valid administrative credentials and authenticate to the device.

🎖@cveNotify